Jasig/cas — pull request #383 by mmoayyed (2014-01-09 15:44:33+00:00)
Title: CAS-1410: Failure to create pgtIOU/PGT should not result in successful validation

JIRA:
https://issues.jasig.org/browse/CAS-1410

Relevant sections from the updated protocol doc:

>The service that is requesting a proxy-granting ticket specifies upon
initial service ticket or proxy ticket validation the HTTP request parameter
"pgtUrl" to /serviceValidate (or /proxyValidate). This is a callback URL of
the service to which CAS will connect to verify the service's identity. This
URL MUST be HTTPS and CAS MUST evaluate the endpoint to establish peer trust.
Building trust at a minimum involves utilizing PKIX and employing container trust to
validate the signature, chain and the expiration window of the certificate of the
callback url. The generation of the proxy-granting-ticket or the corresponding
proxy granting ticket IOU may fail due to the proxy callback url failing to meet the minimum
security requirements such as failure to establishing trust between peers or unresponsiveness
of the endpoint, etc. In case of failure, no proxy-granting ticket will be issued and the CAS
service response as described in Section [2.5.2](#head2.5.2) MUST NOT contain a
\ block. At this point, the issuance of a
proxy-granting ticket is halted and service ticket validation will
fail. Otherwise, the process will proceed normally to step 2.